CVE-2026-92458: yshop-crm Authorization Bypass Vulnerability

CVE-2026-92458 Overview

CVE-2026-92458 is a missing authorization vulnerability [CWE-862] affecting yshop-crm versions through 2.1.3. The flaw resides in the StoreProductControlleronSale handler, which fails to enforce permission checks before modifying product sale status. Authenticated back-office users can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs. This allows attackers to withdraw entire product catalogs from sale or re-enable previously withdrawn products. The vulnerability affects an e-commerce customer relationship management platform where product availability directly impacts business operations.

Critical Impact

Any authenticated administrative user can toggle the sale status of every product in the catalog, causing catalog-wide business disruption without triggering authorization errors.

Affected Products

• yshop-crm through version 2.1.3
• StoreProductController component in the yshop-module-product-biz module
• StoreProductServiceImpl backing service

Discovery Timeline

• 2026-09-16 - CVE-2026-92458 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92458

Vulnerability Analysis

The vulnerability exists in the yshop-crm mall module, specifically within the administrative product management controller. The onSale handler exposes a GET endpoint at /admin-api/product/store-product/sale that toggles the sale status of a product identified by its ID parameter. The handler validates that the caller is authenticated but does not verify whether the caller holds the permission required to modify product listings. As a result, any user with a valid back-office session token can iterate through sequential product IDs and flip the sale state of every product in the store. The issue is classified under CWE-862: Missing Authorization.

Root Cause

The root cause is the absence of a role-based or permission-based authorization annotation on the controller method. In similar Spring-based back-office frameworks, sensitive product-mutation endpoints are expected to be guarded by a permission check such as @PreAuthorize referencing a fine-grained permission string. The onSale handler bypasses this convention. See the StoreProductController source and the StoreProductServiceImpl source for the vulnerable code paths.

Attack Vector

An attacker requires a valid authenticated session in the administrative back office. The attacker sends repeated GET requests to /admin-api/product/store-product/sale while incrementing the product ID query parameter. Each request toggles the sale flag on the targeted product. A published proof of concept demonstrates automated iteration across product IDs. See the GitHub PoC Script and the VulnCheck Advisory for yshop-crm for additional technical detail.

Detection Methods for CVE-2026-92458

Indicators of Compromise

• High-frequency GET requests to /admin-api/product/store-product/sale from a single session or IP address.
• Sequential product ID values in the request query string, indicating enumeration rather than legitimate administrative use.
• Unexpected transitions of product isShow or sale-status fields in the store_product database table.

Detection Strategies

• Deploy web application firewall rules that rate-limit requests to /admin-api/product/store-product/sale per authenticated session.
• Audit application logs for back-office users invoking the sale toggle endpoint outside of expected product management workflows.
• Correlate database update events on product sale status against the identity of the invoking administrative account.

Monitoring Recommendations

• Enable verbose access logging on all /admin-api/product/store-product/* routes and forward logs to a centralized SIEM.
• Alert on any single account modifying more than a defined threshold of product records within a short time window.
• Track baseline product-catalog change velocity and trigger investigations when velocity exceeds normal operational patterns.

How to Mitigate CVE-2026-92458

Immediate Actions Required

• Restrict network access to the /admin-api/ prefix to trusted administrator IP ranges or a VPN.
• Review the back-office user roster and disable accounts that do not require product management privileges.
• Add a permission check to the onSale handler in StoreProductController before deploying to production.
• Audit recent product sale status changes and revert any unauthorized toggles.

Patch Information

No official vendor patch has been published in the referenced advisories at the time of writing. Operators should apply the source-level fix by adding an authorization annotation on the onSale handler and rebuilding the yshop-module-product-biz module. Track the yshop-crm repository for upstream fixes.

Workarounds

• Place a reverse proxy in front of the application that blocks GET /admin-api/product/store-product/sale requests from accounts lacking the product-management role.
• Implement request throttling on the sale toggle endpoint to limit the blast radius of enumeration attempts.
• Enforce multi-factor authentication for all back-office accounts to reduce the risk of session compromise leading to abuse.

# Example nginx rule to restrict the vulnerable endpoint by source IP
location = /admin-api/product/store-product/sale {
    allow 10.0.0.0/24;   # trusted admin network
    deny  all;
    proxy_pass http://yshop_backend;
}